Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does somebody has an idea, that what kind of iptables/pf rule must i use to achieve this?:

i only want to allow these connections [on the output chain]:

on port 53 output only allow udp - dns
on port 80 output only allow tcp - http
on port 443 output only allow tcp - https
on port 993 output only allow tcp - imaps
on port 465 output only allow tcp - smtps
on port 22 output only allow tcp - ssh
on port 20-21 output only allow cp - ftp
on port 989-990 output only allow tcp - ftps
on port 1194 output only allow udp - OpenVPN

So that e.g.: OpenVPN on port 443 would be blocked, because only HTTPS is allowed on port 443 outbound.

Any ideas? :\

share|improve this question
up vote 3 down vote accepted

Take a look at

That describes how to use the "Layer 7" module in iptables rules for deep packet inspection.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.